aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHarald Welte <laforge@osmocom.org>2020-06-08 20:46:53 +0200
committerHarald Welte <laforge@osmocom.org>2020-06-08 20:46:53 +0200
commit627e285fd0dc82aeb15f0c35c946190da40e6f8c (patch)
tree6854f8183cdeca74dc2d8a5b89ec1c94a91f1d6b
parent5e0b829884d2cd939b14b8fa6d88d9242094b06f (diff)
Fix memory leak when SNDCP de-fragmentation is used
As msgb ownership is not passed along, we need to free the message buffer memory we allocate in defrag_segments() after calling sgsn_rx_sndcp_ud_ind(). Change-Id: I1185b1aa99bb167d616eb469e5445e4ed5ad949d Closes: OS#4603
-rw-r--r--src/sgsn/gprs_sndcp.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/src/sgsn/gprs_sndcp.c b/src/sgsn/gprs_sndcp.c
index 01be57ef..7ce69600 100644
--- a/src/sgsn/gprs_sndcp.c
+++ b/src/sgsn/gprs_sndcp.c
@@ -366,6 +366,10 @@ static int defrag_segments(struct gprs_sndcp_entity *sne)
rc = sgsn_rx_sndcp_ud_ind(&sne->ra_id, sne->lle->llme->tlli,
sne->nsapi, msg, npdu_len, expnd);
+ /* we must free the memory we allocated above; ownership is not transferred
+ * downwards in the call above */
+ msgb_free(msg);
+
if (any_pcomp_or_dcomp_active(sgsn))
talloc_free(expnd);